Vulnerabilities > CVE-2013-1665 - Information Exposure vulnerability in Openstack Folsom and Keystone Essex

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2013-237.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(74936);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2013-0208", "CVE-2013-0212", "CVE-2013-0247", "CVE-2013-0282", "CVE-2013-0335", "CVE-2013-1664", "CVE-2013-1665", "CVE-2013-1838", "CVE-2013-1840");

  script_name(english:"openSUSE Security Update : openstack (openSUSE-2013-237)");
  script_summary(english:"Check for the openSUSE-2013-237 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The Openstack Stack components were updated to Folsom level as of
March 5th.

Changes in openstack-cinder :

  - Update 12.3 packages to Folsom as of March 5th. This
    comes with security fixes and bug fixes that we need to
    have OpenStack work nicely. Fix bnc#802278.

  - Update cinder-config-update.diff: update
    etc/cinder/api-paste.ini to have a signing_dir key under
    [filter:authtoken]. Otherwise, cinder-api won't start.
    This was done with commit de289a6 in Grizzly.

  - Update to version 2012.2.4+git.1362502414.95a620b :

  + Check for non-default volume name template.

  + Fix error for extra specs update with empty body.

  - Update to version 2012.2.4+git.1361527687.68de70d :

  + Add a safe_minidom_parse_string function.
    (CVE-2013-1664)

  - Set auth_strategy to keystone for a good out-of-the-box
    experience

  - Add cinder-config-update.diff: move configuration
    changes to a patch, instead of using sed.

  - Update to version 2012.2.4+git.1360133755.a8caa79 :

  + Final versioning for 2012.2.3

  + Bump version to 2012.2.4

  + Fix typo in cinder/db/api.py

  - Update to version 2012.2.3+git.1358429029.cdf6c13 :

  + Add commands used by NFS volume driver to rootwrap

Changes in openstack-dashboard :

  - Update 12.3 packages to Folsom as of March 5th. This
    comes with security fixes and bug fixes that we need to
    have OpenStack work nicely. Fix bnc#802278.

  - Backport packaging changes we did for Grizzly to fix
    theming :

  + define a production %bcond_with that will determine
    whether offline compression is used or not.

  + if not using the production feature, have a nodejs
    Requires.

  + move compression steps to %prep.

  + by default, use the non-production mode for greater
    flexibility.

  - Do not use 'SUSE Cloud' as site branding: this is not
    SUSE Cloud.

  - Update to version 2012.2.4+git.1362503968.8ece3c7 :

  + pin django to 1.4.x stream

  - Update to version 2012.2.4+git.1361527741.0a42fa0 :

  + Prevent the user from creating a single IP address sized
    network

  + Add UTC offset information to the timezone

  - Update to version 2012.2.4+git.1360133827.f421145 :

  + Final versioning for 2012.2.3

  + Bump version to 2012.2.4

  - Update to version 2012.2.2+git.1359111868.20fa0fc :

  + Pin docutils to 0.9.1, fix pep8 errors

  + Fix bug 1055929 - Can not display usage data for Quota
    Summary.

  + Revert 'Temp fix for api/keystone.py'

  + Specify floating ips table action column's width

  + Allow setting nova quotas to unlimited

  + Add a check for unlimited quotas

  + Avoid cinder calls, when cinder is unavailable

  + Don't inherit from base.html in 500 error page

  + Don't show the EC2 Credentials panel if there is no EC2
    service

  - Drop horizon-ssl.patch: merged upstream.

Changes in openstack-glance :

  - Do not return location in headers (CVE-2013-1840)

  - This fixes bnc#808626.

  - Update 12.3 packages to Folsom as of March 5th. This
    comes with· security fixes and bug fixes that we
    need to have OpenStack work nicely. Fix bnc#802278.

  - Update to version 2012.2.4+git.1362583521.1fb759d :

  + Swallow UserWarning from glance-cache-manage

  + Avoid dangling partial image on size/checksum mismatch

  - Update to version 2012.2.4+git.1362503824.afe6166 :

  + Fix broken JSON schemas in v2 tests

  + Prints list-cached dates in isoformat

  - Update to version 2012.2.4+git.1360133885.98d9928 :

  + Bump version to 2012.2.4

  - Update to version 2012.2.3+git.1359529730.a5b0f4e :

  + Change useexisting to extend_existing to fix deprecation
    warnings.

  + Remove Swift location/password from messages.
    (CVE-2013-0212)

Changes in openstack-keystone :

  - Update 12.3 packages to Folsom as of March 5th. This
    comes with· security fixes and bug fixes that we
    need to have OpenStack work nicely. Fix bnc#802278.

  - fix logging.conf to be about keystone and have absolute
    path

  - Update to version 2012.2.4+git.1362502288.8690166 :

  + Sync timeutils to pick up normalize fix.

  + Backport of fix for 24-hour failure of pki.

  - Update to version 2012.2.4+git.1361527873.37b3532 :

  + Disable XML entity parsing (CVE-2013-1664,
    CVE-2013-1665)

  + Ensure user and tenant enabled in EC2 (CVE-2013-0282)

  - Update to version 2012.2.4+git.1360133921.82c87e5 :

  + Bump version to 2012.2.4

  + Add size validations for /tokens. (CVE-2013-0247)

  - Update to version 2012.2.3+git.1359550485.ec7b94d :

  + Test 0.2.0 keystoneclient to avoid new deps

  + Unparseable endpoint URL's should raise friendly error

  + Fix catalog when services have no URL

  + Render content-type appropriate 404 (bug 1089987)

  - fix last commit's hash tag in Version

Changes in openstack-nova :

  - Add quotas for fixed ips. (CVE-2013-1838)

  - Update to version 2012.2.3+git.1358515929.3545a7d :

  + Add NFS to the libvirt volume driver list

  + Call plug_vifs() for all instances in init_host

  + Fix addition of CPU features when running against legacy
    libvirt

  + Fix typo in resource tracker audit message

  - Move back to 'git_tarballs' source service.

  - Start using obs-service-github_tarballs

  - Update to version 2012.2.3+git.1358434328.a41b913 :

  + Provide better error message for aggregate-create

  + Fix errors in used_limits extension

  + Add an iptables mangle rule per-bridge for DHCP.

  + Limit formatting routes when adding resources

  - Update 12.3 packages to Folsom as of March 5th. This
    comes with· security fixes and bug fixes that we
    need to have OpenStack work nicely. Fix bnc#802278.

  - Install polkit rules file in
    /usr/share/polkit-1/rules.d/ since it's not a
    configuration file, and use 10 instead of 50 as priority
    to make sure it is taken into account.

  - Update to version 2012.2.4+git.1362583574.da38af5 :

  + VNC Token Validation (CVE-2013-0335)

  - Update to version 2012.2.4+git.1362502642.8c4df00 :

  + Ensure we add a new line when appending to rc.local

  + Handle compute node not available for live migration

  + remove intermediate libvirt downloaded images

  - Add openstack-nova-polkit.rules: polkit rules for the
    new polkit that uses JavaScript. On openSUSE 12.3 and
    later, we install this file in /etc/polkit-1/rules.d/
    instead of installing the pkla file which is of no use
    with the new polkit.

  - Update to version 2012.2.4+git.1361527907.d5e7f55 :

  + Avoid stuck task_state on snapshot image failure

  + Add a safe_minidom_parse_string function.
    (CVE-2013-1664)

  + Enable libvirt to work with NoopFirewallDriver

  + Fix state sync logic related to the PAUSED VM state

  + libvirt: Fix nova-compute start when missing ip.

  - Update to version 2012.2.4+git.1360133953.e5d0f4b :

  + Final versioning for 2012.2.3

  + Bump version to 2012.2.4

  - Update to version 2012.2.3+git.1359529791.317cc0a :

  + remove session parameter from fixed_ip_get

  + Eliminate race conditions in floating association

  + Fix to include error message in instance faults

  + disallow boot from volume from specifying arbitrary
    volumes (CVE-2013-0208)

  - Update to version 2012.2.3+git.1359111576.03c3e9b :

  + Ensure that Quantum uses configured fixed IP

  + Makes sure compute doesn't crash on failed resume.

  - Update to version 2012.2.3+git.1358515929.3545a7d :

  + Add NFS to the libvirt volume driver list

  + Call plug_vifs() for all instances in init_host

  + Fix addition of CPU features when running against legacy
    libvirt

  + Fix typo in resource tracker audit message

  - Move back to 'git_tarballs' source service.

  - Start using obs-service-github_tarballs

  - Update to version 2012.2.3+git.1358434328.a41b913 :

  + Provide better error message for aggregate-create

  + Fix errors in used_limits extension

  + Add an iptables mangle rule per-bridge for DHCP.

  + Limit formatting routes when adding resources

Changes in openstack-quantum :

  - Update 12.3 packages to Folsom as of March 5th. This
    comes with· security fixes and bug fixes that we
    need to have OpenStack work nicely. Fix bnc#802278.

  - Update to version 2012.2.4+git.1362583635.f94b149 :

  + L3 port delete prevention: do not raise if no IP on port

  - Update to version 2012.2.4+git.1362504084.06e42f8 :

  + Close file descriptors when executing sub-processes

  + Persist updated expiration time

  - Update to version 2012.2.4+git.1361527969.4de49b4 :

  + only destroy single namespace if router_id is set

  + Enable OVS and NETNS utilities to perform logging

  + Disable dhcp_domain distribution when dhcp_domain is
    empty

  + Shorten the DHCP default resync_interval

  - Update to version 2012.2.4+git.1360134016.d2a85e6 :

  + Final versioning for 2012.2.3

  + Bump version to 2012.2.4

  - Update to version 2012.2.3+git.1359529852.a84ba7e :

  + Regression caused by commit b56c2c998

  + LinuxBridge: update status according to admin_state_up

  + Ensure that correct root helper is used

Changes in openstack-quickstart :

  - Update 12.3 packages to Folsom as of March 5th. This
    comes with· security fixes and bug fixes that we
    need to have OpenStack work nicely. Fix bnc#802278.

  - Update to latest git (cb0fbe8) :

  + Enalbe Cinder and Swift Service endpoints

  + Setup Cinder properly

  - Update to latest git (95d7088) :

  + Fill in values in the cinder/api-paste.ini templatae

Changes in openstack-swift :

  - Update to version 1.7.4.1+git.1359529903.0ce3e1d :

  + Use pypi for python-swiftclient dependency.

  - Update 12.3 packages to Folsom as of March 5th. This
    comes with· security fixes and bug fixes that we
    need to have OpenStack work nicely. Fix bnc#802278.

  - Update to version 1.7.4.1+git.1359529903.0ce3e1d :

  + Use pypi for python-swiftclient dependency.

Changes in python-cinderclient :

  - Update 12.3 packages to Folsom as of March 5th. This
    comes with· security fixes and bug fixes that we
    need to have OpenStack work nicely. Fix bnc#802278.

  - Add compat-newer-requests.patch: take patches from
    upstream to allow working with newer versions of
    python-requests.

Changes in python-django_openstack_auth :

  - Update 12.3 packages to Folsom as of March 5th. This
    comes with· security fixes and bug fixes that we
    need to have OpenStack work nicely. Fix bnc#802278.

  - Update to version 1.0.6 :

  + Fix compatibility with keystoneclient v0.2.

  - Changes from version 1.0.5 :

  + Improves error handling; fixes failing test.

Changes in python-keystoneclient :

  - Update 12.3 packages to Folsom as of March 5th. This
    comes with· security fixes and bug fixes that we
    need to have OpenStack work nicely. Fix bnc#802278.

  - Add compat-newer-requests.patch: take patches from
    upstream to allow working with newer versions of
    python-requests."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=802278"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=808622"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=808626"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected openstack packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-cinder");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-cinder-api");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-cinder-scheduler");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-cinder-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-cinder-volume");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-dashboard");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-dashboard-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-glance");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-glance-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-keystone");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-keystone-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-api");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-cert");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-compute");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-network");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-novncproxy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-objectstore");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-scheduler");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-vncproxy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-nova-volume");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-quantum");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-quantum-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-quickstart");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift-account");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift-container");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift-object");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift-proxy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openstack-swift-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-cinder");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-cinderclient");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-cinderclient-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-django_openstack_auth");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-glance");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-horizon");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-keystone");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-keystoneclient");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-keystoneclient-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-nova");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-quantum");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-swift");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.3");

  script_set_attribute(attribute:"patch_publication_date", value:"2013/03/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2020 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE12\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.3", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);



flag = 0;

if ( rpm_check(release:"SUSE12.3", reference:"openstack-cinder-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-cinder-api-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-cinder-scheduler-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-cinder-test-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-cinder-volume-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-dashboard-2012.2.4+git.1362503968.8ece3c7-2.5.2") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-dashboard-test-2012.2.4+git.1362503968.8ece3c7-2.5.2") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-glance-2012.2.4+git.1363297737.dd849a9-2.6.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-glance-test-2012.2.4+git.1363297737.dd849a9-2.6.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-keystone-2012.2.4+git.1362502288.8690166-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-keystone-test-2012.2.4+git.1362502288.8690166-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-api-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-cert-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-compute-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-network-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-novncproxy-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-objectstore-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-scheduler-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-test-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-vncproxy-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-nova-volume-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-quantum-2012.2.4+git.1362583635.f94b149-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-quantum-test-2012.2.4+git.1362583635.f94b149-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-quickstart-2012.2+git.1360262230.cb0fbe8-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-account-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-container-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-object-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-proxy-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"openstack-swift-test-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"python-cinder-2012.2.4+git.1362502414.95a620b-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"python-cinderclient-1.0.1.5.g82e47d0+git.1355912775.82e47d0-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"python-cinderclient-test-1.0.1.5.g82e47d0+git.1355912775.82e47d0-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"python-django_openstack_auth-1.0.6-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"python-glance-2012.2.4+git.1363297737.dd849a9-2.6.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"python-horizon-2012.2.4+git.1362503968.8ece3c7-2.5.2") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"python-keystone-2012.2.4+git.1362502288.8690166-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"python-keystoneclient-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"python-keystoneclient-test-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"python-nova-2012.2.4+git.1363297910.9561484-2.6.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"python-quantum-2012.2.4+git.1362583635.f94b149-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"python-swift-1.7.4.1+git.1359529903.0ce3e1d-2.4.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openstack");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-2634. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(64898);
  script_version("1.8");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2012-4520", "CVE-2013-0305", "CVE-2013-0306", "CVE-2013-1665");
  script_bugtraq_id(56146, 58022, 58061);
  script_xref(name:"DSA", value:"2634");

  script_name(english:"Debian DSA-2634-1 : python-django - several vulnerabilities");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Several vulnerabilities have been discovered in Django, a high-level
Python web development framework. The Common Vulnerabilities and
Exposures project identifies the following problems :

  - CVE-2012-4520
    James Kettle discovered that Django did not properly
    filter the HTTP Host header when processing certain
    requests. An attacker could exploit this to generate and
    cause parts of Django, particularly the password-reset
    mechanism, to display arbitrary URLs to users.

  - CVE-2013-0305
    Orange Tsai discovered that the bundled administrative
    interface of Django could expose supposedly-hidden
    information via its history log.

  - CVE-2013-0306
    Mozilla discovered that an attacker can abuse Django's
    tracking of the number of forms in a formset to cause a
    denial-of-service attack due to extreme memory
    consumption.

  - CVE-2013-1665
    Michael Koziarski discovered that Django's XML
    deserialization is vulnerable to entity-expansion and
    external-entity/DTD attacks."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701186"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=696535"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691145"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2012-4520"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2013-0305"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2013-0306"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2013-1665"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/squeeze/python-django"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2013/dsa-2634"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the python-django packages.

For the stable distribution (squeeze), these problems have been fixed
in version 1.2.3-3+squeeze5."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python-django");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:6.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2013/02/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/02/27");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"6.0", prefix:"python-django", reference:"1.2.3-3+squeeze5")) flag++;
if (deb_check(release:"6.0", prefix:"python-django-doc", reference:"1.2.3-3+squeeze5")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from the FreeBSD VuXML database :
#
# Copyright 2003-2018 Jacques Vidrine and contributors
#
# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
# HTML, PDF, PostScript, RTF and so forth) with or without modification,
# are permitted provided that the following conditions are met:
# 1. Redistributions of source code (VuXML) must retain the above
#    copyright notice, this list of conditions and the following
#    disclaimer as the first lines of this file unmodified.
# 2. Redistributions in compiled form (transformed to other DTDs,
#    published online in any format, converted to PDF, PostScript,
#    RTF and other formats) must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer
#    in the documentation and/or other materials provided with the
#    distribution.
# 
# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#

include("compat.inc");

if (description)
{
  script_id(64873);
  script_version("1.6");
  script_cvs_date("Date: 2018/12/05 20:31:22");

  script_cve_id("CVE-2013-0305", "CVE-2013-0306", "CVE-2013-1664", "CVE-2013-1665");
  script_bugtraq_id(58022, 58061);

  script_name(english:"FreeBSD : django -- multiple vulnerabilities (21c59f5e-7cc5-11e2-9c11-080027a5ec9a)");
  script_summary(english:"Checks for updated packages in pkg_info output");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote FreeBSD host is missing one or more security-related
updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The Django Project reports :

These security releases fix four issues: one potential phishing
vector, one denial-of-service vector, an information leakage issue,
and a range of XML vulnerabilities.

- Host header poisoning

an attacker could cause Django to generate and display URLs that link
to arbitrary domains. This could be used as part of a phishing attack.
These releases fix this problem by introducing a new setting,
ALLOWED_HOSTS, which specifies a whitelist of domains your site is
known to respond to.

Important: by default Django 1.3.6 and 1.4.4 set ALLOWED_HOSTS to
allow all hosts. This means that to actually fix the security
vulnerability you should define this setting yourself immediately
after upgrading.

- Formset denial-of-service

an attacker can abuse Django's tracking of the number of forms in a
formset to cause a denial-of-service attack. This has been fixed by
adding a default maximum number of forms of 1,000. You can still
manually specify a bigger max_num, if you wish, but 1,000 should be
enough for anyone.

- XML attacks

Django's serialization framework was vulnerable to attacks via XML
entity expansion and external references; this is now fixed. However,
if you're parsing arbitrary XML in other parts of your application, we
recommend you look into the defusedxml Python packages which remedy
this anywhere you parse XML, not just via Django's serialization
framework.

- Data leakage via admin history log

Django's admin interface could expose supposedly-hidden information
via its history log. This has been fixed."
  );
  # https://vuxml.freebsd.org/freebsd/21c59f5e-7cc5-11e2-9c11-080027a5ec9a.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?325e72d2"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py26-django");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:py27-django");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/02/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2013/02/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/02/25");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"FreeBSD Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");

  exit(0);
}


include("audit.inc");
include("freebsd_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (pkg_test(save_report:TRUE, pkg:"py26-django>=1.3<1.3.6")) flag++;
if (pkg_test(save_report:TRUE, pkg:"py26-django>=1.4<1.4.4")) flag++;
if (pkg_test(save_report:TRUE, pkg:"py27-django>=1.3<1.3.6")) flag++;
if (pkg_test(save_report:TRUE, pkg:"py27-django>=1.4<1.4.4")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2013-589.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(75089);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2012-4520", "CVE-2013-0305", "CVE-2013-0306", "CVE-2013-1665");

  script_name(english:"openSUSE Security Update : python-django (openSUSE-SU-2013:1203-1)");
  script_summary(english:"Check for the openSUSE-2013-589 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"python-django was updated to 1.4.5 to fix various security issues and
bugs.

Update to 1.4.5 :

  - Security release.

  - Fix bnc#807175 / bnc#787521 / CVE-2012-4520 /
    CVE-2013-0305 / CVE-2013-0306 and CVE-2013-1665.

  - Update to 1.4.3 :

  - Security release :

  - Host header poisoning

  - Redirect poisoning

  - Please check release notes for details:
    https://www.djangoproject.com/weblog/2012/dec/10/securit
    y

  - Add a symlink from /usr/bin/django-admin.py to
    /usr/bin/django-admin

  - Update to 1.4.2 :

  - Security release :

  - Host header poisoning

  - Please check release notes for details:
    https://www.djangoproject.com/weblog/2012/oct/17/securit
    y

  - Update to 1.4.1 :

  - Security release :

  - Cross-site scripting in authentication views

  - Denial-of-service in image validation

  - Denial-of-service via get_image_dimensions()

  - Please check release notes for details:
    https://www.djangoproject.com/weblog/2012/jul/30/securit
    y-releases-issued

  - Add patch to support CSRF_COOKIE_HTTPONLY config"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=787521"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=807175"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://lists.opensuse.org/opensuse-updates/2013-07/msg00058.html"
  );
  # https://www.djangoproject.com/weblog/2012/dec/10/security
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.djangoproject.com/weblog/2012/dec/10/security/"
  );
  # https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?85c9c56c"
  );
  # https://www.djangoproject.com/weblog/2012/oct/17/security
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.djangoproject.com/weblog/2012/oct/17/security/"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected python-django package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-django");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.3");

  script_set_attribute(attribute:"patch_publication_date", value:"2013/07/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE12\.2|SUSE12\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.2 / 12.3", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);



flag = 0;

if ( rpm_check(release:"SUSE12.2", reference:"python-django-1.4.5-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"python-django-1.4.5-2.4.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-django");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2013-2916.
#

include("compat.inc");

if (description)
{
  script_id(64997);
  script_version("1.12");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2013-0282", "CVE-2013-1664", "CVE-2013-1665");
  script_bugtraq_id(58022, 58033);
  script_xref(name:"FEDORA", value:"2013-2916");

  script_name(english:"Fedora 18 : openstack-keystone-2012.2.3-3.fc18 (2013-2916)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"security updates: - ensure user and tenant are enabled CVE-2013-0282 -
disable XML entity parsing CVE-2013-1664, CVE-2013-1665

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=910221"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=910928"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2013-March/099648.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?9fe96274"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected openstack-keystone package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:openstack-keystone");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:18");

  script_set_attribute(attribute:"patch_publication_date", value:"2013/02/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/03/05");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^18([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 18.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC18", reference:"openstack-keystone-2012.2.3-3.fc18")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openstack-keystone");
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-1730-1. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include("compat.inc");

if (description)
{
  script_id(64782);
  script_version("1.11");
  script_cvs_date("Date: 2019/09/19 12:54:28");

  script_cve_id("CVE-2013-0282", "CVE-2013-1664", "CVE-2013-1665");
  script_xref(name:"USN", value:"1730-1");

  script_name(english:"Ubuntu 12.04 LTS / 12.10 : keystone vulnerabilities (USN-1730-1)");
  script_summary(english:"Checks dpkg output for updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Ubuntu host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Nathanael Burton discovered that Keystone did not properly verify
disabled users. An authenticated but disabled user would continue to
have access rights that were removed. (CVE-2013-0282)

Jonathan Murray discovered that Keystone would allow XML entity
processing. A remote unauthenticated attacker could exploit this to
cause a denial of service via resource exhaustion. Authenticated users
could also use this to view arbitrary files on the Keystone server.
(CVE-2013-1664, CVE-2013-1665).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://usn.ubuntu.com/1730-1/"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected python-keystone package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python-keystone");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.10");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/04/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2013/02/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/02/21");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Ubuntu Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("ubuntu.inc");
include("misc_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Ubuntu/release");
if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
release = chomp(release);
if (! preg(pattern:"^(12\.04|12\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 12.04 / 12.10", "Ubuntu " + release);
if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);

flag = 0;

if (ubuntu_check(osver:"12.04", pkgname:"python-keystone", pkgver:"2012.1+stable~20120824-a16a0ab9-0ubuntu2.5")) flag++;
if (ubuntu_check(osver:"12.10", pkgname:"python-keystone", pkgver:"2012.2.1-0ubuntu1.2")) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-keystone");
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-1757-1. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include("compat.inc");

if (description)
{
  script_id(65096);
  script_version("1.8");
  script_cvs_date("Date: 2019/09/19 12:54:29");

  script_cve_id("CVE-2012-4520", "CVE-2013-0305", "CVE-2013-0306", "CVE-2013-1664", "CVE-2013-1665");
  script_bugtraq_id(56146, 58022, 58061);
  script_xref(name:"USN", value:"1757-1");

  script_name(english:"Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : python-django vulnerabilities (USN-1757-1)");
  script_summary(english:"Checks dpkg output for updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Ubuntu host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"James Kettle discovered that Django did not properly filter the Host
HTTP header when processing certain requests. An attacker could
exploit this to generate and display arbitrary URLs to users. Although
this issue had been previously addressed in USN-1632-1, this update
adds additional hardening measures to host header validation. This
update also adds a new ALLOWED_HOSTS setting that can be set to a list
of acceptable values for headers. (CVE-2012-4520)

Orange Tsai discovered that Django incorrectly performed permission
checks when displaying the history view in the admin interface. An
administrator could use this flaw to view the history of any object,
regardless of intended permissions. (CVE-2013-0305)

It was discovered that Django incorrectly handled a large number of
forms when generating formsets. An attacker could use this flaw to
cause Django to consume memory, resulting in a denial of service.
(CVE-2013-0306)

It was discovered that Django incorrectly deserialized XML. An
attacker could use this flaw to perform entity-expansion and
external-entity/DTD attacks. This updated modified Django behaviour to
no longer allow DTDs, perform entity expansion, or fetch external
entities/DTDs. (CVE-2013-1664, CVE-2013-1665).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://usn.ubuntu.com/1757-1/"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected python-django package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python-django");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:10.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.10");

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/11/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2013/03/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/03/08");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Ubuntu Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("ubuntu.inc");
include("misc_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Ubuntu/release");
if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
release = chomp(release);
if (! preg(pattern:"^(10\.04|11\.10|12\.04|12\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 10.04 / 11.10 / 12.04 / 12.10", "Ubuntu " + release);
if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);

flag = 0;

if (ubuntu_check(osver:"10.04", pkgname:"python-django", pkgver:"1.1.1-2ubuntu1.8")) flag++;
if (ubuntu_check(osver:"11.10", pkgname:"python-django", pkgver:"1.3-2ubuntu1.6")) flag++;
if (ubuntu_check(osver:"12.04", pkgname:"python-django", pkgver:"1.3.1-4ubuntu1.6")) flag++;
if (ubuntu_check(osver:"12.10", pkgname:"python-django", pkgver:"1.4.1-2ubuntu0.3")) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-django");
}